Havuz

Proper sandboxing for agentic coding and web browsing

A privacy-first, local-first password manager with cross-platform synchronization.

Runtime security for AI agents: discover agents, map their permissions, and enforce what they can do.

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, de

A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine

Laravel Security Tool

Credential gateway for AI agents. Log in once via Oauth2 or API Key. Every agent stays authenticated — headless, no SaaS, agents never see y

AI-powered multi-agent security auditor for Symfony applications, provider-agnostic via symfony/ai.

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code pl

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PH

Audit and fix your Mac's security in one command. No agent, no signup, open source.

Local, evidence-based application security assessment engine and Claude Code plugin

Offline password, identity, and secret vault. Argon2id + AES-256-GCM, zero servers, zero telemetry.

Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.

Evidence-driven Java security review workbench

👻 AI-Powered Pentesting Command Center — Autonomous security testing with real-time streaming, self-improving AI, unlimited tool iterations,

LLM-native static vulnerability detection: point it at a repo and get a reviewable vuln report, the way a human auditor would.

A modular, drop-in middleware collection for Laravel AI SDK agents. Offers middleware across security, observability, performance and guidan

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CI

Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerabili

AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server

surface-watch monitors the authorized external attack surface of an organization over time

Local-first credential manager & validator for red teams / pentest：致力于 ALL IN ONE 的本地凭据管理与验证平台。 允许将红队渗透测试中获取的散落在各处的 API Key、云厂商 AK/SK、机器人 To

Local-first code audit workbench for Opengrep. Scan locally, track findings across versions, verify fixes, and produce reproducible security

A Linux CLI utility that transparently routes all system traffic through the Tor network using nftables. It enables rapid IP rotation and ea

AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy,

Defense-in-depth security toolkit for LLM agents — taint tracking, proxy secret guard, policy engine, and red-team benchmarking

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request,

JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

OSINT tool for precise version fingerprinting of open-source web software

Verify what AI coding agents can actually read, write, execute and reach using synthetic canaries.

C2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel

A curated collection of AI SecOps 24 SKILL.md capabilities for security work offensive security, SOC and detection engineering, cloud and Ku

AI agent firewall that intercepts tool calls (file, shell, network) and enforces deterministic policies at sub-microsecond latency using CEL

Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali

A small multithreaded TCP port scanner in plain C (POSIX sockets + pthreads), zero dependencies.

A codebase scanner that helps you not run malicous code

A lightweight Windows PC remote screen monitoring and endpoint activity audit tool. Fast setup, live screen streaming, and silent background

Modular browser-based OSINT toolkit — curated search tools, PII Redactor, multi-country IBAN analysis and embedded CyberChef. No backend req

A lightweight network security tool that verifies IP location, validates network safety, and prevents access to protected links when unexpec

Browser-based Android console, APK decompiler and security analyzer. Mirror, logcat, shell, Frida, jadx, and static and dynamic analysis, wi

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, cove

Concurrent Go CLI that detects hidden prompt-injection content in documents — invisible Unicode, homoglyphs, hidden HTML, and known trigger

Audit, clean, and harden a WordPress site end to end, with an AI agent (Claude/Cursor/Codex/MCP or SSH). Detects & removes hidden malware —

Detonate files & URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enrich IOCs across MalwareBazaar, ThreatFox, URLhau

Fast, cross-platform CLI for finding secrets and sensitive data across filesystems, SMB, Active Directory, Microsoft 365, Slack, Jira and Co

TriLane: autonomous AI pentester and multi-agent security auditor for authorized gray-box testing of web apps and APIs. Built with Rust and